In Support, and in Professional Services, best practice is to manually set most of our services to use the SSAdministrator account so that permissions are directly assigned without passing through a medium. Most of these services should be set properly to the SSAdministrator user during installation, but oftentimes due to permissions issues, some of these services do not get set.
There are, however, some services that we do not typically assign the SSAdministrator privilege explicitly. Oftentimes services such as GlobalAction/GlobalCapture are left to run as Local System as well as MongoDB. From a Windows perspective, these services will use a restricted local account with some system privileges. These are listed in the services.msc console as “Local System”.
...